SOA-C02 Reliability and Business Continuity Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable S3 Object Lock in Compliance mode.

  Why this is correct

  S3 Object Lock in Compliance mode enforces a write-once-read-many (WORM) model, preventing any user — including the AWS account root user — from deleting or overwriting the log objects for the specified retention period. Because CloudTrail log files become immutable once written, this directly satisfies the need to preserve audit activity for 7 years in an unmodifiable state.

• ✗

  Enable S3 Versioning on the CloudTrail S3 bucket.

  Why it's wrong here

  While S3 Versioning preserves previous versions of objects, it does not prevent a user with the s3:DeleteObject permission from deleting the current version of a CloudTrail log, and overwriting an object simply creates a new version rather than being rejected. Versioning alone is a data protection feature, not a WORM control, so audit logs could still be permanently removed or altered unless an external policy such as Object Lock or an S3 bucket policy denying deletes is also applied.

• ✗

  Move CloudTrail logs to Amazon S3 Glacier after 90 days.

  Why it's wrong here

  Moving CloudTrail logs to S3 Glacier via a lifecycle policy changes only the storage class; it does not automatically make the objects immutable. Glacier retains the same IAM permission model and object mutability as Standard S3, so an authorized user could still delete or overwrite the archived logs. To achieve WORM protection in Glacier, you would need to enable S3 Object Lock on the bucket with a retention mode — the lifecycle transition alone is insufficient.

• ✗

  Store logs in Amazon CloudWatch Logs with an expiration policy of 7 years.

  Why it's wrong here

  A CloudWatch Logs expiration policy only controls how long log events are retained before they are automatically expired; it does not provide any sort of write-once-read-many protection. Log groups or log streams can still be deleted at any time by an IAM principal with the logs:DeleteLogGroup or logs:DeleteLogStream permission, and there is no equivalent to S3 Object Lock's compliance mode available on CloudWatch Logs. Therefore, while convenient for querying, it does not meet a strict 7-year immutability requirement.

Go deeper

Related to this question